Cloud Digital Leader Practice Exam 57 — 20 Questions

Question 1

A company wants to implement a hybrid cloud architecture connecting their on-premises data center to Google Cloud. They need high bandwidth (10 Gbps), low latency, and a service-level agreement (SLA). Which TWO services can provide dedicated connectivity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Interconnect (Partner). Cloud Interconnect (Partner) (C) is correct because it provides dedicated connectivity to Google Cloud through a supported partner, delivering high bandwidth up to 10 Gbps or more with low latency and a Google-backed SLA for hybrid architectures. Cloud Interconnect (Dedicated) (D) is also correct because it offers a direct physical connection between the on-premises data center and Google's network, supporting 10 Gbps or 100 Gbps links with low latency and an SLA, exactly matching the stated requirements. HA VPN (A) and Cloud VPN (E) are incorrect because they are IPsec VPN tunnels over the public internet, which cannot guarantee the dedicated 10 Gbps bandwidth or low-latency SLA required here. Cloud CDN (B) is incorrect because it is a content delivery network for caching and serving web content at the edge, not a connectivity service between on-premises and Google Cloud.

Answer

HA VPN

Answer

Cloud CDN

Answer

Cloud VPN

Question 2

A company wants to implement a data pipeline that ingests streaming events from a global user base, processes them in real-time to detect anomalies, and stores the results in a database for low-latency querying. The solution must be fully managed. Which THREE services should they use? (Choose 3)

Accepted Answer

Dataflow. Option D (Pub/Sub) is correct because it is a fully managed, globally scalable messaging service designed to ingest high-volume streaming events from a worldwide user base and reliably deliver them to downstream processing systems. Option A (Dataflow) is correct because it is a fully managed, serverless stream and batch processing service that can consume Pub/Sub messages and perform real-time anomaly detection using Apache Beam pipelines. Option C (Cloud Bigtable) is correct because it is a fully managed, low-latency NoSQL database that scales horizontally and is well suited for storing and querying the pipeline's results with millisecond latency. Option B (Cloud Storage) is not appropriate as the primary sink for low-latency querying, since it is object storage optimized for large blobs rather than fast row-level reads. Option E (Cloud Functions) is not suitable as the core stream-processing engine here, because it is an event-driven serverless function service with execution time and concurrency limits, not a managed pipeline for continuous, high-throughput stream analytics.

Answer

Cloud Storage

Answer

Cloud Functions

Question 3

A regional accounting firm is moving its document management system to Google Cloud. The firm's partners are concerned about where client financial records will physically reside and want assurance that the data stays within their country. They also want to understand who is responsible for securing the underlying physical data center versus the application configuration. Which statement accurately describes the Google Cloud shared responsibility model in this context?

Accepted Answer

Google is responsible for the security of the cloud, including physical data centers and hardware, while the firm is responsible for security in the cloud, including data and application configuration. The shared responsibility model divides duties: Google handles security of the cloud, meaning the physical facilities, hardware, and core infrastructure, while the customer handles security in the cloud, meaning data, identities, and application configuration. The firm retains control over client records and access settings, while relying on Google for data center safeguards and residency through region selection.

Answer

The firm is responsible for physical data center security because it retains ownership of the data, while Google only manages software updates

Answer

Google is responsible for securing both the infrastructure and all customer data, so the firm does not need to configure access controls

Answer

Responsibility is split evenly, with Google and the firm jointly configuring the hypervisor and guest operating system for every workload

Question 4

A company is migrating a PostgreSQL database to Google Cloud. They want high performance, AI-optimized capabilities, and compatibility with existing PostgreSQL tools. Which service should they choose?

Accepted Answer

AlloyDB. AlloyDB is a PostgreSQL-compatible database optimized for high performance and AI workloads, with built-in ML integration. Cloud SQL for PostgreSQL provides compatibility but lacks AI optimization. Spanner is a different architecture. Bigtable is NoSQL.

Answer

Cloud Spanner

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Question 5

A global gaming company needs to serve low-latency content to players worldwide. They want to cache static assets (images, videos) at edge locations closest to users. Which Google Cloud product should they use?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge network Points of Presence (PoPs) to cache content, reducing latency for users worldwide.

Answer

Cloud Storage

Answer

Compute Engine with global load balancer

Answer

Cloud Spanner

Question 6

A regional grocery chain wants to modernize how it responds to local demand. Store managers currently email weekly spreadsheets to headquarters, where analysts compile reports three days later. The chain's leadership asks a cloud consultant how moving this workflow to Google Cloud changes the way the business can operate, rather than just where the servers run. Which statement best describes the business transformation the consultant should emphasize?

Accepted Answer

The chain gains the ability to act on near-real-time store data, shifting decisions closer to the point of sale and enabling faster, localized responses.. The meaningful transformation comes from changing the speed and location of decisions. When store-level sales and inventory signals flow into Google Cloud continuously, the chain can replenish stock, adjust promotions, and staff stores based on current conditions instead of last week's spreadsheet. That reorients the organization toward the customer and the point of sale, which is a business-model shift rather than a simple hosting change.

Answer

The chain reduces its total cost of ownership because it no longer purchases servers, and cost reduction is the primary meaning of digital transformation in this context.

Answer

The chain eliminates the need for analysts entirely, because cloud analytics platforms automatically generate every business decision without human judgment.

Answer

The chain must migrate the spreadsheet process unchanged to a Compute Engine virtual machine so that headquarters retains the same three-day reporting cadence with better hardware.

Question 7

A regional healthcare provider wants to give its clinicians a new patient-scheduling application but is concerned about the time and cost of procuring servers, configuring networking, and patching operating systems. Leadership asks how moving to Google Cloud would change the way the IT team spends its time. Which business benefit of cloud technology best describes this shift?

Accepted Answer

The IT team can shift effort away from maintaining undifferentiated infrastructure and toward work that differentiates the organization.. Cloud providers operate the physical facilities, servers, storage, and much of the platform software, so customers stop spending scarce engineering time on repetitive infrastructure chores. That reclaimed capacity can be redirected to applications, integrations, and services that create value for patients and clinicians. The other choices either overstate what Google manages, promise unguaranteed outcomes, or confuse infrastructure with application ownership.

Answer

The organization no longer needs to design, test, or operate the scheduling application itself.

Answer

The organization can eliminate all IT operational spending because Google manages every layer of the stack.

Answer

Application performance automatically improves because Google's network is faster than any private network.

Question 8

A retail company runs a customer-facing web application on Compute Engine instances. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to mitigate distributed denial-of-service (DDoS) attacks without modifying the application code. Which Google Cloud service should the company implement to meet these requirements?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it is the Google Cloud edge security service that integrates with external HTTP(S) load balancers to deliver WAF filtering and DDoS protection. Its preconfigured rules defend against OWASP Top 10 threats like SQL injection and cross-site scripting, and its rate-based and adaptive protection rules absorb volumetric attacks. Because enforcement happens at the load balancer, the application itself remains unchanged, meeting every requirement in the scenario.

Answer

VPC Service Controls

Answer

Cloud Identity-Aware Proxy

Answer

Cloud NAT

Question 9

A healthcare company runs a containerized patient-records application on Google Kubernetes Engine. The security team wants to detect and block suspicious network traffic between pods, and also wants to scan container images for known vulnerabilities before deployment. Which combination of Google Cloud services should they use to meet these requirements?

Accepted Answer

GKE network policies with Dataplane V2 for pod traffic and Artifact Registry vulnerability scanning for images. Protecting containerized workloads requires layered controls. GKE network policies with Dataplane V2 enforce pod-level firewall rules inside the cluster, while Artifact Registry provides automated vulnerability scanning of container images. Cloud Armor and VPC Service Controls operate at different layers and cannot inspect pod-to-pod traffic, so they do not fulfill the east-west traffic requirement.

Answer

Cloud Armor for pod-to-pod traffic filtering and Container Registry for image scanning

Answer

Google Cloud Armor for pod traffic and Artifact Registry vulnerability scanning for images

Answer

VPC Service Controls for pod traffic and Binary Authorization for image scanning

Question 10

A retail company runs its order-processing application on Compute Engine instances in a single zone. During a regional maintenance event, the zone becomes unavailable for several hours, and the application goes down. The operations team wants to improve resilience so that a single zone failure does not cause an outage, while keeping changes minimal. What should they do?

Accepted Answer

Create a managed instance group with instances spread across multiple zones in the same region, and configure an HTTP(S) load balancer to distribute traffic.. The most effective way to survive a single-zone failure is to distribute instances across multiple zones within a region using a managed instance group, and to use a load balancer to route traffic to healthy instances. This design removes the single point of failure and aligns with Google Cloud's regional resource model. Other options either do not address zone-level failures or add unnecessary components.

Answer

Enable live migration for all instances so that they automatically move to another zone when the current zone fails.

Answer

Configure a Cloud VPN tunnel between the affected zone and a second zone, and replicate the application state over that tunnel.

Answer

Move the application to a single, larger instance with a higher availability SLA so that it is less likely to fail.

Question 11

A startup's engineering team wants to monitor the CPU utilization of its Compute Engine instances and receive an alert when utilization exceeds 80% for 5 minutes. They want a fully managed Google Cloud solution that requires minimal setup and integrates with their existing dashboards. Which Google Cloud service should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring is the Google Cloud service for collecting metrics, creating dashboards, and setting up alerts. It automatically collects CPU utilization from Compute Engine instances and allows you to define an alerting policy that triggers when the metric exceeds a threshold for a specified duration. This matches the team's need for a managed, low-effort monitoring solution.

Answer

Cloud Logging

Answer

Cloud Profiler

Answer

Cloud Trace

Question 12

A retail company runs a customer-facing web application on Compute Engine instances behind an external Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting, and also wants to restrict access to only known good IP addresses. They need a managed solution that integrates with the load balancer and requires minimal operational overhead. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it is a managed WAF and DDoS protection service that integrates with external Application Load Balancers. It provides preconfigured rules to block common web attacks like SQL injection and XSS, and allows IP allowlisting/denylisting through security policies. This aligns with the need for a low-overhead, integrated security solution.

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Answer

VPC Service Controls

Question 13

A financial services company stores sensitive customer data in Cloud Storage buckets. Their security policy requires that all data be encrypted at rest using customer-managed encryption keys (CMEKs) that the company controls and can rotate independently. They also need to audit key usage and ensure that if a key is disabled, data becomes inaccessible. Which Google Cloud service should they use to manage these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service because it enables the creation and management of customer-managed encryption keys (CMEKs) for Cloud Storage. It supports key rotation, provides audit logs for key usage, and allows disabling keys to revoke access. This satisfies the financial company's requirements for control, auditing, and data inaccessibility upon key disablement.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud Hardware Security Module (Cloud HSM)

Answer

Cloud External Key Manager (Cloud EKM)

Question 14

A retail company is experiencing unpredictable traffic spikes. Which cloud characteristic allows them to automatically add resources during peak demand and remove them when demand drops?

Accepted Answer

Elasticity. Elasticity (option B) is correct because it is the cloud characteristic that automatically scales resources out during peak demand and scales them back in when demand drops, matching the retail company's unpredictable traffic spikes. Global reach (option A) refers to deploying resources across multiple geographic regions to serve users closer, not to automatic scaling. High availability (option C) focuses on keeping services continuously accessible and resilient, typically through redundancy, not on adding or removing capacity with demand. Pay-as-you-go (option D) is a billing model where you pay only for consumed resources, but it does not itself perform the automatic scaling.

Answer

Global reach

Answer

High availability

Answer

Pay-as-you-go

Question 15

Which TWO actions are the customer's responsibility under the GCP shared responsibility model?

Accepted Answer

Managing user accounts and authentication. Under the GCP shared responsibility model, the customer is responsible for managing their own user accounts and authentication (Option A), since identity lifecycle, credential management, and authentication configuration for their users fall on the customer side of the line. The customer is also responsible for configuring IAM policies to control access (Option C), because defining who can do what on which resources via roles and bindings is a customer-controlled security task. By contrast, encryption of data at rest by default (Option B) is provided by Google as part of the platform's baseline security, network infrastructure maintenance (Option D) is handled by Google, and physical security of data centers (Option E) is entirely Google's responsibility.

Answer

Encryption of data at rest by default

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 16

A global enterprise must store customer data in specific geographic regions to comply with data residency laws. They also need to be able to analyze data across all regions without centralizing it. Which approach best balances compliance and analytics?

Accepted Answer

Use regional Cloud Storage buckets per region and BigQuery with federated queries.. Regional Cloud Storage buckets keep each region's customer data physically within its required geography, satisfying data residency laws, while BigQuery federated queries (external tables over Cloud Storage) let analysts query that data in place across regions without copying or centralizing it. This combination preserves compliance and enables cross-regional analytics. Option A does not provide a cross-region analytics mechanism and would require custom data movement or query federation, adding complexity and risk. Option C centralizes all data in one region, directly violating residency requirements. Option D uses a multi-region bucket, which may replicate data outside the mandated region and thus fails the residency constraint.

Answer

Deploy identical Compute Engine instances with databases in each region.

Answer

Store all data in a single region and use Cloud CDN for fast access.

Answer

Use a single Cloud Storage multi-region bucket with granular access controls.

Question 17

A company uses the lifecycle configuration above for archival data that is rarely accessed. What business benefit does this provide?

Accepted Answer

Reduced storage costs by transitioning to cheaper tiers and deleting obsolete data. A lifecycle configuration is designed to automatically transition objects to lower-cost storage classes (such as infrequent access or archive tiers) as they age and to expire/delete objects once they are no longer needed, which directly lowers storage spend for rarely accessed archival data. This matches the stated scenario of archival data that is rarely accessed, where the main business benefit is cost optimization rather than performance or security. Option A does not fit because encryption is a security control, not a lifecycle action, and lifecycle rules do not provide encryption. Option B does not fit because lifecycle policies typically move data to slower, cheaper tiers, which can increase retrieval latency rather than speed it up. Option D does not fit because cross-region replication is a separate feature (e.g., S3 Cross-Region Replication) and is not what a lifecycle configuration accomplishes.

Answer

Improved data security through encryption

Answer

Faster data retrieval for frequently accessed files

Answer

Automatic replication to another region for disaster recovery

Question 18

A company wants to protect sensitive data stored in Cloud Storage from being downloaded by users outside their organization. They also need to prevent data from being copied to external projects. Which TWO services should they use? (Choose two.)

Accepted Answer

IAM conditions with access levels. IAM conditions with access levels (A) are correct because they let you enforce context-aware access rules on Cloud Storage, such as allowing access only when the request originates from a trusted network or device, which directly addresses preventing downloads by users outside the organization. VPC Service Controls (C) are correct because they create a service perimeter around Cloud Storage that blocks data exfiltration, including preventing data from being copied to external projects outside the perimeter. Cloud DLP (B) is incorrect because it is used to discover, classify, and redact sensitive data, not to enforce access or exfiltration boundaries. Cloud KMS (D) is incorrect because it manages encryption keys and does not control who can download or copy data. Cloud Armor (E) is incorrect because it protects web applications from network-layer and application-layer attacks at the edge, not Cloud Storage data access or project boundaries.

Answer

Cloud DLP

Answer

Cloud KMS

Answer

Cloud Armor

Question 19

A company uses Cloud SQL for PostgreSQL and needs to run complex analytical queries on the same dataset without affecting the performance of the transactional database. What should they do?

Accepted Answer

Create read replicas of the Cloud SQL instance and run queries on the replicas. Cloud SQL read replicas maintain a continuously updated copy of the primary instance and serve read-only traffic, so complex analytical queries can be offloaded to the replica without consuming the primary instance's CPU, memory, or I/O resources. This isolates the transactional workload from the analytical workload while keeping the same PostgreSQL dataset. Option A is not ideal because periodic exports are stale and require managing a separate BigQuery pipeline, not real-time querying of the same dataset. Option C only adds capacity to the primary instance and does not separate analytical load from transactional traffic. Option D is unsuitable because BigQuery federated queries against Cloud SQL still send query load to the Cloud SQL instance, affecting transactional performance.

Answer

Schedule periodic exports to Cloud Storage and query with BigQuery

Answer

Upgrade the Cloud SQL instance to a higher machine type

Answer

Use BigQuery to directly query Cloud SQL via federated queries

Question 20

A manufacturing company wants to use sensor data from equipment to predict failures before they happen, reducing downtime. How does cloud technology enable this transformation?

Accepted Answer

By offering IoT Core and AI Platform to collect data and build predictive models. Option D is correct because cloud providers offer managed IoT services such as AWS IoT Core or Azure IoT Hub to ingest sensor telemetry at scale, paired with AI/ML platforms (e.g., Amazon SageMaker, Azure Machine Learning) to train predictive maintenance models that forecast failures before they occur. This combination directly enables the transformation from reactive to predictive maintenance, reducing unplanned downtime. Option A is wrong because storing all data locally with edge computing limits centralized analytics and model training, and edge computing is typically used for low-latency filtering, not bulk storage. Option B is insufficient because monitoring alerts are reactive threshold notifications, not predictive modeling. Option C is wrong because batch analysis in a data warehouse does not provide the real-time streaming ingestion and ML model deployment needed for failure prediction.

Answer

By using edge computing to store all data locally

Answer

By setting up monitoring alerts for equipment failure

Answer

By migrating all data to a data warehouse for batch analysis